Dynamic Document Clustering and Keyword Extraction

ABSTRACT

Systems, methods and apparatuses are disclosed to cluster a plurality of documents located in any number of local and/or remote systems and applications. Preprocessed text is generated for each document, and a hash and a feature vector are determined based on the preprocessed text. A set of clusters is retrieved, wherein each cluster is associated with a hash list and a cumulative feature vector. Each of the documents may then be associated with a cluster by comparing the hash of the document to the hash lists of the clusters and/or by determining similarities between the feature vector of the document and the cumulative feature vectors of the clusters.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims the benefit of U.S. provisional patentapplication Ser. No. 62/824,373, titled “Dynamic Document Clustering andKeyword Extraction,” filed Mar. 27, 2019 and U.S. provisional patentapplication Ser. No. 62/935,642, titled “Dynamic Document Clustering andKeyword Extraction,” filed Nov. 15, 2019, each of which is incorporatedby reference herein in its entirety.

BACKGROUND

This specification relates generally to organizing unstructured data.More specifically, this specification relates to systems and methods forclassifying unstructured documents into clusters of unstructuredinformation stored in any number of data sources and for monitoringaccess to such information to manage customer privacy.

In the digital economy, preserving customer confidence and trustrequires protecting their personal identity information from loss, theftand misuse. Information technology and the Internet have made it easierto steal personal information through breaches of Internet security,network security and web browser security, leading to a profitablemarket in collecting and reselling personal information. Personalinformation may also be exploited by criminals to stalk or steal theidentity of a person, or to aid in the planning of criminal acts.

The primary challenge most organizations face today, as it relates todata protection, is understanding where customers' personal informationis located across the organization's data centers. Although a number ofsoftware solutions exist to allow organizations to identify and protectpersonal information stored in structured files and databases, suchsolutions are not applicable to unstructured content, such as documents(e.g., text files, word processing documents, presentations, etc.)stored in file shares, personal computing devices, content managementsystems and various other internal and external systems. Unfortunately,unstructured files are ubiquitous in today's business environment, asthey may be generated using many applications, stored as and/orconverted into multiple file formats, and may include nearly unlimitedform and content.

Accordingly, there remains a need for systems and methods that canorganize unstructured data into logical units in order to allow forpersonal information to be identified and understood. Moreover, due tothe enormous size and complexity of typical “big data” file shares, itwould be beneficial if such solutions were designed to be highlyefficient in terms of computation time and memory requirements.

SUMMARY

In accordance with the foregoing objectives and others, exemplaryembodiments are described herein to allow for efficient organization ofunstructured data. The described embodiments may employ hybrid, dynamicfile clustering algorithms to search documents located across any numberof local and/or cloud-based systems and applications to cluster suchdocuments into coherent, logical units according to their contents. Incontrast to conventional clustering algorithms, the describedembodiments may be employed to cluster documents without previousknowledge of the total number of desired clusters and may be employed inparallel to document scanning functions.

In certain embodiments, the systems and methods described herein mayextract important keywords from generated document clusters to provideinsights into the contents of underlying documents. Accordingly, theembodiments may detect hidden patterns in unstructured file shares toallow organizations to determine which clusters include documents withpersonal information and/or documents to which access should bemonitored or limited.

In one aspect of the embodiments, a computer-implemented method ofclustering a plurality of documents is provided. The method may include:receiving a plurality of documents from one or more data sources;preprocessing a document in the plurality of documents to generatepreprocessed text including a plurality of tokens; applying a hashingfunction to the preprocessed text to calculate a hash of the document;determining a feature vector of the document based on the preprocessedtext; retrieving a set of clusters, each cluster associated with one ormore associated documents, a hash list, and a cumulative feature vector;determining a comparison score between the hash of the document and eachof the hash lists of the clusters; determining a similarity scorebetween the feature vector of the document and each of the cumulativefeature vectors of the clusters; and associating the document with acluster based on the determined comparison scores or the determinedsimilarity scores.

If the comparison score between the hash of the document and the hashlist of a matching cluster in the set of clusters is determined to begreater than or equal to a comparison threshold, the document may beassociated with the matching cluster. However, if none of the determinedcomparison scores is greater than or equal to a first comparisonthreshold, a maximum comparison score may be determined from thedetermined comparison scores; and, upon determining that the maximumcomparison score is greater than or equal to a second comparisonthreshold that is lower than the first comparison threshold, thedocument may be associated with the cluster corresponding to the maximumcomparison score.

In some cases, the similarity score between the feature vector of thedocument and each of the cumulative feature vectors of the clusters maybe determined when none of the determined comparison scores is greaterthan or equal to a comparison threshold (e.g., the second comparisonthreshold). In such cases, the document may be associated with a clusterwhen the similarity score between the feature vector of the document andthe cumulative feature vector of the cluster is determined to be greaterthan or equal to a first similarity threshold. However, if none of thedetermined similarity scores is greater than or equal to the firstsimilarity threshold, a maximum similarity score may be determined fromthe determined similarity scores; and, upon determining that the maximumsimilarity score is greater than or equal to a second similaritythreshold that is lower than the first similarity threshold, thedocument may be associated with the cluster corresponding to the maximumsimilarity score.

Additionally or alternatively, the method may include: determining asimilarity score between the cumulative feature vectors of a firstcluster and a second cluster in the set of clusters; and merging thefirst cluster with the second cluster upon determining that thesimilarity score is greater than or equal to a predetermined clustersimilarity threshold. It will be appreciated that merging the firstcluster with the second cluster may include associating the associateddocuments of the first cluster with the second cluster; adding thecumulative feature vector of the first cluster to the cumulative featurevector of the second cluster; and/or adding one or more hashes includedin the hash list of the first cluster to the hash list of the secondcluster.

In certain cases, the method may optionally include determining keywordsof a cluster in the set of clusters by, for example: determining a setof tokens for the cluster, the set of tokens including the tokensincluded in the preprocessed text generated for each of the documentsassociated with the cluster; calculating a Term Frequency InverseCluster Frequency (“TFICF”) value for each token in the set of tokens;selecting tokens from the set of tokens based on the calculated TFICFvalues; and designating each of the selected tokens as a keyword. Thekeywords may then be displayed or otherwise transmitted (e.g., to a userdevice).

In another aspect of the embodiments, a machine-readable medium havingprogram instructions stored thereon is provided. The instructions may becapable of execution by a processor and may define steps, such as butnot limited to: receiving a plurality of documents from one or more datasources; preprocessing a document in the plurality of documents togenerate preprocessed text including a plurality of tokens; applying ahashing function to the preprocessed text to calculate a hash of thedocument; and determining a feature vector of the document based on thepreprocessed text. The instructions may further define steps such as:retrieving a set of clusters, each cluster associated with one or moredocuments, a hash list including hashes of some or all of the associateddocuments, and a cumulative feature vector determined based on thefeature vectors of some or all of the associated documents; determininga comparison score between the hash of the document and each of the hashlists of the clusters; determining a similarity score between thefeature vector of the document and each of the cumulative featurevectors of the clusters; and associating the document with a clusterbased on the determined comparison scores or the determined similarityscores.

In certain cases, the instructions may further define steps such as:upon determining that none of the determined comparison scores isgreater than or equal to a first comparison threshold, determining amaximum comparison score from the determined comparison scores and/ordetermining that the maximum comparison score is less than a secondcomparison threshold that is lower than the first comparison threshold.Upon determining that none of the determined similarity scores isgreater than or equal to a first similarity threshold, a maximumsimilarity score may be determined from the determined similarityscores, wherein the maximum similarity score corresponding to a matchingcluster from the set of clusters. If the maximum similarity score isdetermined to be greater than or equal to a second similarity thresholdthat is less than the first similarity threshold, the document may beassociated with the matching cluster, such that the hash of the documentis added to the hash list of the matching cluster and the feature vectorof the document is included in the cumulative feature vector of thematching cluster.

Additionally or alternatively, the instructions may define steps suchas: determining a set of tokens for the matching cluster, wherein theset includes all of the tokens in the preprocessed text generated foreach of the documents associated with the matching cluster; calculatinga TFICF value for each token in the set of tokens; selecting, from theset of tokens, a number of selected tokens based on the calculated TFICFvalues; and designating each of the selected tokens as a keyword of thematching cluster. In some cases, the keywords of the matching clustermay be displayed via a user interface or otherwise transmitted to a userdevice.

The details of one or more embodiments of the subject matter of thisspecification are set forth in the accompanying drawings and thedescription below. Other features, aspects, and advantages of thesubject matter will become apparent from the description, the drawings,and the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows an exemplary document clustering and keyword extractionmethod 100 according to an embodiment.

FIG. 2 shows an exemplary method 200 of scanning one or more datasources to retrieve documents, preprocessing the retrieved documents,generating a document feature vector for each of the preprocesseddocuments, and generating a hash for each of the preprocessed documents.

FIG. 3 shows an exemplary method 300 of clustering documents accordingto an embodiment.

FIGS. 4A-4B show graphical results 410, 420 relating to documentclusters generated during experiments, including computation speed andcluster sizes.

FIGS. 5A-5B show graphical results 510, 520 relating to documentclusters generated during experiments, including distributions of cosinesimilarities between documents and corresponding clusters.

FIG. 6 shows an exemplary method 600 of determining and displayingcluster keywords according to an embodiment.

FIG. 7 shows an exemplary document labeling method 700 according to anembodiment.

FIG. 8 shows an exemplary system 800 according to an embodiment.

DETAILED DESCRIPTION

Various systems, computer-implemented methods, apparatuses and softwareapplications are disclosed that transform unstructured documents intoorganized, logical units (e.g., units comprised of similar documents)allowing hidden patterns to emerge from unstructured data stores. Thedescribed embodiments are very efficient in terms of runtime and memoryconsumption, and allow for better understanding and control of otherwiseunmanageable big data environments. Moreover, the clusters produced bythe described embodiments may form the basis for many higher orderprocesses, such as recommendations for access governance, subject accessrequests and other data discovery applications.

Referring to FIG. 1, an exemplary overview method 100 according to anembodiment is illustrated. As shown, the method 100 includes scanningone or more unstructured data sources to retrieve documents 105,preprocessing the retrieved documents 110, calculating a hash for eachof the preprocessed documents 112, generating a feature vector for eachof the preprocessed documents 115, associating each of the documentswith a cluster 120, determining cluster information, such as importantkeywords, for each cluster of documents 125, and/or displaying suchcluster information for one or more of the document clusters 130. Eachof the steps shown in FIG. 1 is described in detail below.

Referring to FIG. 2, an exemplary method 200 of scanning an unstructureddata source to retrieve documents, preprocessing retrieved documents,and generating a document feature vector and a hash for eachpreprocessed document is illustrated. As shown, the method 200 begins atstep 205, where a scanner scans one or more unstructured data sources tolocate documents stored therein.

The term “document” is used herein to refer to any unstructured object,file, document, sequence, data segment, etc. A document may comprise orotherwise be represented by document information such as textual contextand/or any associated metadata information. Exemplary textual contentmay include, but is not limited to, characters, words, sequences,symbols, etc. And exemplary metadata information may include, but is notlimited to, date created, date modified, date last opened, tags, author,custodian, recipient, copyees, assignee, signatories, party names,audience, brand, language, personal identity information present, wordcount, page count, source, tone/sentiment, security level, attachmentrange, file type/extension, path name, hash value, signature date,effective date, and/or expiration date.

Exemplary documents may comprise textual documents, such as but notlimited to, email messages, text messages, instant messages and othersocial media posts, word processing files (e.g., Microsoft Word™documents), PDF files, spreadsheets (e.g., Microsoft Excel™spreadsheets), presentations (e.g., Microsoft PowerPoint™presentations), collaboration software, etc.

The system may search some or all documents stored by an organizationacross various unstructured data sources. In one embodiment, documentsmay be accessed over an internal and/or external network, the Internet,or the like. Exemplary data sources may include, for example,unstructured databases and file shares, semi-structured Big Data andNoSQL repositories (e.g., Apache Hadoop, RDB and MongoDB), cloud storagesystems, collaboration tools, customer relationship management (“CRM”)systems, data protection solutions, document management systems,ecommerce systems, human resources systems, user directories (e.g.,Lightweight Directory Access Protocol (“LDAP”)) and/or other internal orexternal applications.

In certain embodiments, the system may determine and/or receive datasource information associated with one or more data sources, such as aname, location, type and/or access information of the data source. Forexample, a user may manually enter data source information into a clientapplication and/or may upload a file containing such information. Asanother example, the system may be configured to automatically discoverone or more data sources, along with any corresponding data sourceinformation. The system may employ open source tools such as NMAP,Cacti, Nagios, Icinga, and others to perform data source discovery.

In any event, the system may connect to one or more data sources basedon the determined and/or received data source information and, onceconnected, the system may conduct a search for documents containedtherein. In one embodiment, as documents are discovered in a datasource, the system may retrieve and store such documents forpreprocessing. In other embodiments, the system may store pointers todocuments (e.g., a secure hash used for search), rather than thedocument itself for privacy reasons.

At step 210, a current document is preprocessed. Generally,preprocessing of a document may include one or more of: transformingdocument text to lowercase, removing (e.g., filtering) HTML, XML and/orother programming language tags, removing excess whitespace, removingpunctuation, removing stop words, removing short words (e.g., wordscomprising less than 3 characters or less than 4 characters), removingnumeric characters, and/or word stemming or lemmatization. It will beappreciated that the system may preprocess individual documents and/ormay preprocess batches of documents retrieved from database.

In one embodiment, the system may remove one or more stop words from adocument. Stop words may include parts of speech (e.g., articles,copulas, prepositions, etc.) and/or other common terms that do notcontribute to characterization of the text (e.g., “the,” “I,” “we,”“Inc.,” etc.).

Preprocessing may additionally or alternatively include word stemming orlemmatization. That is, words may be reduced to their respective roots(e.g., parts of words common to all variants of that word). In this way,words with the same root may be grouped as the same word stem indownstream processing steps.

An example of a document text before and after preprocessing is shown inTable 1 below.

TABLE 1 Original Text Compared to Preprocessed Text Original TextPreprocessed Text <p class=“excerpt”>Grouping and group cluster freetext clustering free text is an important important advance make advancetowards making good use of it. good use present algorithm We present analgorithm for unsupervised unsupervise text cluster text clusteringapproach that enables approach enable business business toprogrammatically bin this programmatically bin data data.</p>

At steps 215, 220 and 225, a document feature vector is generated forthe preprocessed current document. Generally, the document featurevector may comprise a numerical representation of a document, such as anN-dimensional vector of numerical features representing a document. Inone embodiment, ‘N’ corresponds to the number of unique words, or“tokens,” in the corpora and the numerical features comprise adetermined numerical value associated with each token (e.g., the numberof occurrences of a given token in the respective document).

At step 215, each token in the preprocessed current document is mappedto a unique ID. In one embodiment, each of the tokens may be mapped to aunique ID number via the use of a dictionary comprising a vocabulary ofterms, where each term is associated with a unique ID. In suchembodiment, a dictionary may be constructed by (1) pre-scanning atraining dataset (i.e., a plurality of preprocessed documents) to buildup a vocabulary of terms and (2) associating each term with a unique ID.

Unfortunately, creating a dictionary requires processing power and time.Accordingly, in an alternative embodiment, each of the tokens may bemapped to a unique ID 215 via use of the so-called “hashing trick,”which does not require a dictionary. In this case, a hash function(e.g., Adler-32, Cyclic redundancy check checksum, etc.) may be appliedto a token and the resulting hash value may be used as the token'sunique ID. In one particular embodiment, the Adler-32 hash function isemployed, as such algorithm has been found to be very efficient whencompared to other hash functions.

In one embodiment where the hashing trick is employed, the unique ID ofa token may be determined by performing one or more additionalmathematical calculations on the resulting hash value. For example, aunique ID may be determined for a given token by first applying a hashfunction to the token and then performing a modulus operation on theresulting hash value (i.e., dividing the hash value by a large numberand using the remainder as the unique ID).

It will be appreciated that, in some cases, the above-described hashingtrick may result in a plurality of different tokens being assigned thesame unique ID. However, this scenario is very rare for large vocabularysizes (e.g., greater than 10,000,000 terms). And, even if multipletokens are associated with the same unique ID, the system typicallyresolves the token that is relevant for a specific cluster by comparingthe number of documents in the cluster and the number of occurrences ofeach token, as detailed below.

At step 220, once unique IDs have been assigned to all of the tokens inthe preprocessed current document, the number of occurrences of eachtoken may be recorded to create a document feature vector representingthe document (e.g., a bag-of-words (“BOW”) numerical vector). And atstep 225, the document feature vector may be stored in a datastore andassociated with the document from which it was determined.

As shown, the system may preferably determine 222 and store 227 a hashfor the preprocessed current document, in addition to the documentfeature vector. Generally, the system may perform the hashing process(steps 222 and 227) in parallel to the feature vector process (steps215, 220, 225), such that the system may employ the results of theseprocesses to efficiently compare documents to documents and/or documentsto clusters during downstream processing steps.

It has surprisingly been found that the processing time required tocluster large numbers of documents can be significantly reduced byemploying hashing in combination with vectorization. By way ofexplanation, although both processes may generally be employed todetermine how similar one object is to another, hashing andvectorization have different strengths and weaknesses. For example, thecomputation time required to determine a hash for a given preprocesseddocument is an order of magnitude less than that required to determine afeature vector for the same document. As another example, whilevectorization may be employed to identify similarities across a widevariety of documents, hashing can only be employed to identify documentsthat are very similar (i.e., nearly identical).

In one particular embodiment, the system may employ a similarity digestthat is superficially similar to a cryptographic hash when performingthe hashing process (steps 222 and 227). Generally, the similaritydigests employed by the embodiments may include those that utilizeschemes that allow for digests to be encoded and stored in a repository,such that one digest may be compared to another digest. For example,similarity digests may employ schemes based on feature extraction, alocality sensitive hashing (“LSH”) scheme, a context triggered piecewisehashing (“CTPH”) scheme, a fuzzy hash scheme, and/or a trend microlocality sensitive hashing (“TLSH”) scheme.

More specifically, similarity digests employed by the embodiments mayutilize one or more of the following schemes: Nilsimsa, Ssdeep, Min-wiseindependent permutations, SimHash, any of the schemes detailed in U.S.Pat. No. 7,272,602, titled “System and method for unorchestrateddetermination of data sequences using sticky byte factoring to determinebreakpoints in digital sequences” (incorporated by reference herein inits entirety), any of the schemes detailed in Kornblum, Jesse,“Identifying almost identical files using context triggered piecewisehashing,” Digital Investigation 3S (2006) S91-S97 (incorporated byreference herein in its entirety) and/or any of the schemes detailed inOliver, Jonathan et al, “TLSH—A Locality Sensitive Hash,” 4th Cybercrimeand Trustworthy Computing Workshop, November 2013 Sydney, Australia,(incorporated by reference herein in its entirety).

It will be appreciated that, unlike conventional hash algorithms thatcan only be used to determine whether two objects are identical (e.g.,MD5 or SHA-256), the similarity digests employed by the embodimentsallow partial matches between objects to be determined. That is, thesimilarity digests may be used to hash data points into buckets so thatdata points near each other are located in the same buckets with highprobability, while data points far from each other are likely to be indifferent buckets. This facilitates identification of observations withvarious degrees of similarity.

In any event, once a hash (i.e., a digest) is determined for the currentdocument 222 and stored 227, the method continues to step 230 where thesystem determines whether there are additional documents in the datasource(s) for which a document feature vector and a hash has not yetbeen generated. If so, the current document is set to the next documentat step 235 and the method returns to step 205. However, if documentfeature vectors and hashes have been determined for all documents in thedata source(s), the method may end 290.

In certain embodiments, the system may conduct preprocessing,vectorization and/or hashing of documents in parallel with a scanningprocess. As shown in Table 2, below, applying this strategy results inminimal overhead (e.g., about 30%) to the scanning process.

TABLE 2 Document Vectorization Overhead to Scanning Process for 1.2KDocuments Runtime Without Runtime With Document Document VectorizationVectorization Change Regular Scan 0:02:40 0:03:29 30% Regular Scan0:02:42 0:03:36 33% With Regex Classifiers

Referring to FIG. 3, an exemplary method 300 of clustering documents isillustrated. As shown, the method begins at step 301, where the systemdetermines a plurality of clusters. In one embodiment, the system maygenerate a least-recently-used (“LRU”) cache of clusters, wherein thesize of the cache may be automatically determined by the system and/ormanually set by a user.

It will be appreciated that the term “cluster” generally describesdocuments that form a cluster, a cluster object, a cluster featurevector, a cluster hash list, cluster identification information, and/orany other information related to the cluster. For example, when referredto as retrieving or returning a cluster, the actual documents that formthe cluster may not be returned; rather, a representation of the cluster(e.g., the cluster hash list and/or the cluster feature vector) may bereturned or retrieved instead.

At step 305, a current document is retrieved from a datastore.Generally, each of the preprocessed documents may be stored by a queuingmechanism along with its associated feature vector and hash produced by,for example, the method 200 of FIG. 2 until the document is assigned toa cluster (e.g., via the method 300 shown in FIG. 3). In one embodiment,the vectors and hashes may be stored in an unstructured database (e.g.,a MONGO database) and the system may be adapted to “listen” for changesin the database in order to begin the clustering method 300.

At step 311, the system may determine a comparison score between a hashof the current document and hashes stored in a hash list associated withan existing cluster (i.e., a “current cluster”). Generally, thecomparison score may be determined by comparing the current documenthash to each of the document hashes included in a hash list or “clusterhash” associated with the current cluster. It will be appreciated that acluster hash may comprise a list of hashes of some or all of thedocuments that are associated with a given cluster. In one embodiment, acluster hash may comprise a list of about 5 to about 15 document hashes(e.g., about 10 hashes), where each hash in the hash list is associatedwith a document that was recently added to the cluster.

For example, the Nilsima hash uses a 5-byte fixed-size sliding windowthat analyses the input on a byte-by-byte basis and produces trigrams ofpossible combinations of the input characters. The trigrams map into a256-bit array (known as the “accumulator”) to create the hash, and everytime a given position is accessed, its value is incremented. At the endof the processing a 32-byte digest is created according to thefollowing: if the values are above a certain threshold, the value is setto a 1; otherwise, if the values are below the threshold, the value isset to zero. Accordingly, to compare two hashes, the method may checkthe number of identical bits read to the same position. This produces ascore from 0 (dissimilar) to 128 (identical or very similar objects).

At step 316, the system determines whether the current comparison scoreis greater than a first predetermined comparison threshold. In preferredembodiments, such first comparison threshold may be equal to a value offrom about 110 to about 120 (e.g., about 115). If the current comparisonscore is greater than the first threshold, the document is assigned tothe current cluster 350. Otherwise, the method continues to step 321.

At step 321, the system determines whether the current comparison scoreis greater than a maximum comparison score. It will be appreciated thatthe maximum comparison score relates to a comparison score between agiven document hash and one of a plurality of clusters, wherein themaximum comparison score is greater than the comparison scorescalculated for the document hash and all other clusters. In other words,the current document hash will be most similar to the cluster from whichthe maximum comparison score is determined.

It will be appreciated that a current comparison score will typically bedetermined by comparing the current document hash to each of a pluralityof document hashes included in the hash list associated with the currentcluster. For example, a first comparison score may be determined bycomparing the current document hash to a first document hash in the hashlist, a second comparison score may be determined by comparing thecurrent document hash to a second document hash in the hash list, athird comparison score may be determined by comparing the currentdocument hash to a third document hash in the hash list, etc.; and, insome embodiments, the “current comparison score” for the currentdocument and the current cluster may be set to the maximum comparisonscore determined for the current document and all of the hashes in thehash list. In the context of the previous example, if the firstcomparison score is greater than all other comparison scores determinedfor the current document and the current cluster, the current comparisonscore will be set to the first comparison score for the purposes ofcompleting steps 316 and 321.

In any event, if the current comparison score is greater than themaximum comparison score, the method continues to step 326, where thesystem sets the maximum comparison score to the current comparison scoreand sets the matching cluster to the current cluster. However, if thecurrent comparison score is not greater than the maximum comparisonscore, the method skips step 326 and the maximum comparisonscore/matching cluster are not updated.

At step 331, the system determines whether comparison scores have beencalculated between the current document hash and all of the existingclusters. If not, the system updates the current cluster to the nextcluster at step 336 and returns to step 311. However, if comparisonscores have been calculated for each existing cluster, the methodcontinues to step 341.

At step 341, the system determines whether the maximum comparison scoreis greater than or equal to a second comparison threshold. In preferredembodiments this second comparison threshold is lower than the firstcomparison threshold. For example, the second comparison threshold maybe from about 80 to about 90 (e.g., about 85). If the maximum comparisonscore is greater than the second comparison threshold, the methodproceeds to step 350 (discussed below). Otherwise, the method continueson to step 309.

Beginning at step 309, the system employs feature vectors, rather thanhashes, to again try to match the document to one of the clusters.Accordingly, the current cluster is set to the first cluster at step 309and the system determines a similarity score between the currentdocument feature vector and the current cluster at step 310. In oneembodiment, the similarity score may be determined by calculating cosinesimilarity between the current document feature vector and the clusterfeature vector of the current cluster (discussed below). The cosinesimilarity relates to the angle between document vectors when projectedin multi-dimensional space, and such similarity measure is consideredvery accurate for word vectors. Importantly, the measure is influencedonly by the orientation and not the magnitude of the vectors, and themeasure simplifies the calculations that are performed when a documentfeature vector is compared to a cluster feature vector and when acumulative vector is calculated (i.e., when a document is added to acluster).

In certain embodiments, each cluster may be associated with a clusterfeature vector indicative of the documents in that cluster. That is, afeature vector describing and/or generally representative of all thedocuments in a cluster may be generated and/or used in determining asimilarity score between the cluster and a given document featurevector. In some embodiments, the cluster feature vector may be amathematical approximation or calculation of the feature vector of thecluster. For example, the cluster feature vector may be an average ofall the vectors of all the documents associated with that cluster. Inalternative embodiments, the feature vector of one document may beselected as the representative cluster feature vector. The selectedfeature vector may be a feature vector most representative of thedocuments in the cluster.

At step 315, the system determines whether the current similarity scoreis greater than a first predetermined similarity threshold. In preferredembodiments, such first similarity threshold may range from about 0.9 toabout 0.97 (e.g., about 0.91, about 0.92, about 0.93, about 0.94, about0.95, about 0.96 or about 0.97). If the current similarity score isgreater than the first similarity threshold, the document is assigned tothe current cluster 350. Otherwise, the method continues to step 320.

At step 320, the system determines whether the current similarity scoreis greater than a maximum similarity score. It will be appreciated thatthe maximum similarity score relates to a similarity score between agiven document feature vector and one of a plurality of clusters,wherein the maximum similarity score is greater than the similarityscores calculated for the document feature vector and all otherclusters. In other words, the current document feature vector will bemost similar to the cluster from which the maximum similarity score isdetermined.

In any event, if the current similarity score is greater than themaximum similarity score, the method continues to step 325, where thesystem sets the maximum similarity score to the current similarity scoreand sets the matching cluster to the current cluster. However, if thecurrent similarity score is not greater than the maximum similarityscore, the method skips step 325 and the maximum similarityscore/matching cluster are not updated.

At step 330, the system determines whether a similarity score has beencalculated between the current document feature vector and all of theexisting clusters. If not, the system updates the current cluster to thenext cluster at step 335 and returns to step 310. However, if similarityscores have been calculated for each existing cluster, the methodcontinues to step 340.

At step 340, the system determines whether the maximum similarity scoreis greater than or equal to a second predetermined similarity threshold.In preferred embodiments this second similarity threshold is lower thanthe first threshold—at least about 0.7 to about 0.9 (e.g., about 0.7,about 0.75, about 0.8, about 0.85 or less than about 0.9). If not, a newcluster is created at step 345 and the new cluster is set as thematching cluster. However, if the maximum similarity score is greaterthan the second similarity threshold, the method proceeds to step 350.

At step 350, the system assigns the current document to the matchingcluster. As discussed above, the matching cluster corresponds to (1) thecluster from which the maximum comparison score was calculated (i.e.,when the maximum comparison score—which relates to a comparison of adocument hash to a cluster hash list—is greater than or equal to thesecond comparison threshold); (2) the cluster from which the maximumsimilarity score was calculated (i.e., when the maximum similarityscore—which relates to a distance or similarity between a documentvector and a cumulative cluster vector—is greater than or equal to thesecond similarity threshold); or (3) to a new cluster created at step345 (i.e., when the maximum similarity score is less than the secondsimilarity threshold).

Either way, at step 355, the system updates cluster informationassociated with the matching cluster. Generally, the system may updatethe cluster hash of the matching cluster by adding the hash of thecurrent document to a list of representative document hashes (e.g., a“first-in-first-out” hash list of about 10 document hashes).

The system may also create a cumulative feature vector of all documentsthat belong to the matching cluster at step 355. Importantly, comparisonof document feature vectors to this cumulative vector yields goodresults when cosine similarity is used in contrast to other distancemetrics such as Euclidean or Jaccard distance metrics.

At step 360, the system determines whether there are any documents thathave not yet been assigned to a matching cluster. If so, the systemupdates the current document vector to the next document at step 365 andthe method is repeated in order to cluster the next document. However,if no unclustered documents remain, the method continues to final step370.

At final step 370, after all documents have been assigned to a matchingcluster, the system may attempt to merge or combine similar clusters. Inone embodiment, the system may calculate pairwise cosine similaritybetween all clusters or a subset of clusters to determine a similarityscore between each cluster. When the similarity score between a pair ofclusters is greater than or equal to the second predetermined similaritythreshold (e.g., about 0.7), such clusters may be combined. It will beappreciated that, when a cluster is combined with another cluster, itscumulative vector (i.e., its cluster feature vector) is added to thecluster feature vector of the combined cluster and its hash list ismerged with the hash list of the combined cluster.

Although not shown, it will be appreciated that, in some embodiments,the clusters may be periodically sorted during the clustering method300. For example, the clusters may be sorted in descending orderaccording to size. This allows for faster assignment of document featurevectors to matching clusters in environments with large clusters.Additionally or alternatively, in certain embodiments—especially when alarge number of unstructured documents need to be clustered—some or allof the above-described steps may be performed in parallel and thegenerated clusters can be merged throughout the process.

It will also be appreciated that the size and tightness of the clustersis controlled by the first and second thresholds used. For example,higher thresholds (i.e., thresholds that are closer to 1.0) will yield alarge number of smaller clusters. Additionally, using higher thresholdswill result in a tighter distribution of cosine similarity scoresbetween the documents in each cluster and the cluster feature vector ofthe corresponding, matching cluster.

As an experiment, the inventive clustering methods were employed tocluster 7,438 unstructured documents, including 38 Non-DisclosureAgreements (“NDAs”). Specifically, a method employing only featurevectors (“vectorization-only method”) and a method employing bothfeature vectors and hashes (the “combined method”) were both compared toa traditional K-means clustering algorithm. K-Means is a popularunsupervised machine learning algorithm that finds “K” number ofcentroids and assigns every data point to the closest cluster, keepingthe centroids as small as possible. The K-means algorithm worksiteratively to optimize the position of the centroids and stops once thecentroids have stabilized or the number of iterations has been reached.

As shown in the graph 410 illustrated in FIG. 4A, both inventive methods(412, 414) significantly outperformed conventional K-means clustering416 with respect to computation time, and the combined method 412 wasabout 30% faster than the vectorization-only method 414. It will beappreciated that, unlike the inventive clustering methods, K-meansclustering requires a research phase in order to determine the optimalnumber of clusters to generate. The data 416 shown in the graph 410 doesnot include any additional time for this research stage.

As shown in Table 3, below, the combined method also outperformed theK-means algorithm with respect to preciseness of clusters generated. Thecombined method correctly split the 7,438 unstructured documents into 7clusters, including a single cluster containing all 38 NDAs. Althoughthe K-Means algorithm also produced 7 clusters, 3 of the 38 NDAs wereincorrectly assigned to a large cluster (Cluster 1), which containedvery different files.

TABLE 3 Document Clustering Performance Clusters Sizes (# Documents)Cluster Combined Method K-Means 1 1635 1638 2 1545 1545 3 1410 1410 41280 1280 5 1130 1130 6 400 400 7 38 35 (NDAs)

As another experiment, the vectorization-only method was employed tocluster about 120,000 unstructured documents with minimal overhead tothe scanning process runtime. As shown in the graph 420 illustrated inFIG. 4B, most of the files (96.5%) were correctly clustered into the 10largest clusters 422. A similar distribution is expected for manyorganizations that store petabytes of documents because most of thefiles stored by such organizations will comprise templates filled withdifferent data (e.g., company forms, letters and/or presentations).Because the backbone of many documents will be similar, document featurevectors calculated for such documents should also be similar, which willresult in many documents being clustered together.

FIGS. 5A-5B illustrate a distribution of cosine similarities of documentfeature vectors to the cluster feature vector of their corresponding,matching clusters. For better visualization, only the 20 largestclusters are shown. FIG. 5A shows the distribution 510 before clustermerging and FIG. 5B shows the distribution 520 after cluster merging.Accordingly, it will be appreciated that the higher variance shown inFIG. 5B is due to cluster merging

As shown in FIGS. 5A-5B, using a first similarity threshold of 0.90 anda second similarity threshold of 0.85 yielded clusters with a narrowdistribution of cosine similarity scores between the documents in eachcluster and the cluster feature vector of the corresponding cluster. Itwill be appreciated that, because the clustering method is dynamic, someclusters may eventually contain documents associated with a similarityscore that is less than the second threshold. However, this happensquite rarely and can be easily handled by identifying such clusters andassigning the outlier documents to other clusters.

The above-described dynamic clustering methods and the clustersgenerated by such methods may be utilized by many downstreamapplications. In one embodiment, the system may determine and displayresulting clusters and/or various information/statistics relating to thedocuments associated with such clusters. For example, the system maydetermine, store and/or display statistics associated with one or moreclusters, such as: the size of the cluster, average size of thedocuments that compose the cluster, the distribution of file typeswithin the cluster, the distribution of the documents across thedifferent scanned data stores, number of personal data found in thecluster, etc. It will be appreciated that the documents, clusters,and/or information about the documents and/or clusters may be stored inone or more databases.

Referring to FIG. 6, an exemplary method 600 of determining anddisplaying cluster keywords is illustrated. Generally, the system maycalculate representative or important tokens (i.e., keywords) for eachof the clusters and display a number of such keywords to a user (e.g.,based on user preference). In this way, the system may provide a userwith insight into the content of documents associated with one or moreclusters.

As shown, the method 600 begins at step 605, where the system calculatesthe number of times each token occurs in a current cluster (i.e., thetoken frequency (tf). Next, at step 610, the system quantifies thespecificity of each token according to the following formula:

${{icf}\left( {t,c} \right)} = {\log\left( \frac{N}{1 + {\left\{ {c \in {C:t} \in T} \right\} }} \right)}$

where: N equals the total number of clusters and 1+|{c∈C:t∈T}| equalsthe number of clusters that contain the token. To avoid division byzero, the denominator is incremented by one.

At step 615, the system determines one or more important tokens or“keywords” for the current cluster. In one embodiment, the system maydetermine such keywords by calculating TFICF for each token in thecurrent cluster according to the following equation:

tficf(t,c,C)=tf(t,c)·icf(t,C)

As shown, the system determines TFICF for a given token by multiplyingits token frequency (tf) and its specificity (icf). The incorporation ofthe specificity factor diminishes the weight of tokens that occur veryfrequently in a given cluster and increases the weight of tokens thatoccur rarely.

Upon calculating TFICF for each of the plurality of tokens in thecurrent cluster, the system may then compare the calculated values inorder to select one or more keywords from the available tokens. In oneembodiment, the system may select a predetermined number of keywordscorresponding to the tokens having the highest TFICF scores (e.g., apredetermined number that may be configurable by a user). In anotherembodiment, the system may classify any token having a TFICF valuegreater than a predetermined minimum as a keyword. And, in yet anotherembodiment, the system may classify a certain percentage of tokenshaving the highest TFICF values as keywords (e.g., the top 1% of tokensor the top 5% of tokens).

In any event, once one or more keywords have been determined for thecurrent cluster 615, the method continues to step 620, where thedetermined keywords and/or any other cluster or document information maybe stored in one or more databases.

It will be appreciated that the above steps may be repeated, as desiredor required, for each cluster. Accordingly, at step 625, the systemdetermines whether keywords should be generated for any additionalclusters. If so, the system may update the current cluster to the nextcluster at step 630 and return to step 605. Otherwise, the method maycontinue to step 635, where the system displays the keywords determinedfor one or more clusters.

Referring to FIG. 7, an exemplary document labeling method 700 isillustrated. Generally, document labeling comprises categorizingdocuments based on content (e.g. “sensitive,” “marketing,” “financial,”etc.). Document labeling may utilize the availability of the clusteringalgorithm as an unsupervised machine learning method (i.e., where manuallabeling is not required) and/or the power of supervised labeled data.

As shown, a number of documents (711, 712, 721 and 722) originallystored in a data source 705 may be clustered as described above. Forexample, documents 711 and 712 may be assigned to a first cluster 710and documents 721 and 722 may be assigned to a second cluster 720 a.

In one embodiment, when a document 711 is manually labeled 750 beforeclustering, such label may automatically be propagated to all files(e.g., document 712) in a cluster 710 to which the previously labeleddocument is assigned. In another embodiment, one or more documents 722in a given cluster 720 a may be selected and manually labeled 760 by auser, and such label may then be propagated to all documents (e.g.,document 721) in the corresponding cluster 720 b.

Discovering document duplications in large unstructured data stores isanother major application of the described document clustering methods.The naive approach of comparing each document to all other documents ina data store may possibly detect duplications, but is too time consumingand cannot scale. Document clustering can greatly facilitate thedetection of duplicate documents by dramatically reducing the number ofdocuments that should be compared using expensive traditionalalgorithms. For example, following the clustering process, any documentsthat belong to the same cluster and that share exactly the same documentfeature vector may be automatically marked as possible duplications. Inone embodiment, the raw content of such documents may optionally becompared using traditional algorithms to draw a definitive conclusion.

Referring to FIG. 8, an exemplary system according to an embodiment isillustrated. As shown, the system 800 may comprise a microservicesarchitecture that can be deployed from a public cloud or inside anorganization's data center. This architecture allows the system to bedeployed as a simple, single-server deployment or as a multitier, hybridcloud environment comprising one or more on-premise and/or cloud-basedapplications.

The core system components may be designed as microservices that may bepackaged in containers (e.g., DOCKER containers) to facilitatescalability and to allow flexible deployments. When components aredecoupled and can each run in their own isolated environment, it ispossible to scale the system by adding more instances of relevantmicroservices. The container images can be managed, version controlledand downloaded from a container hub, or loaded from compressed files incase the organization's environment does not allow hub access.Generally, each of the components may communicate via a REST API (or amessage queue for asynchronous jobs), and most services may bestateless. It will be appreciated that it is possible for severalmicroservices to share the same container.

Although the system may employ a container service, the coredeliverables may still be maintained in plain code (e.g., JavaScript,Java, etc.). Accordingly, the components can be packaged in differentvirtual machine images or even installed by an installer, if desired orrequired.

As shown, the system may comprise any number of modules, including butnot limited to, a management server module 810, which can be deployedeither in the cloud or on-premise; and a main module 830 which istypically deployed locally. In one embodiment, the main module 830comprises a number of components, such as a shared database component840, an orchestrator component 831, a correlator component 833, a riskanalysis and rules evaluation component 832, a data source discoverycomponent 834, and a number of scanner worker components 850 (e.g., anidentity scanner 851, a Hadoop scanner 852, a file share scanner 853,and/or a third-party system scanner 854).

The shared database component 840 may store information in a number ofdatabase tables (841-847), such as: a documents table 841, a clusterstable 842, a data sources table 843, a rules table 844, an incidentstable 845, an applications table 846 and/or an activities table 847. Asshown various components and/or microservices may access the shareddatabase component 840 to store and/or retrieve information.

In certain embodiments, a data source discovery component 834 may beemployed. The discovery component may be adapted to search for availabledata sources (e.g., using network discovery). Data source informationassociated with found data sources may be stored in the shared database840 (e.g., in the data sources table 843).

As shown, the system may comprise a number of distributed, on-premisescanner worker components 850 that are adapted to scan for and retrievedocuments from various data sources 860. As discussed above, exemplarydocument findings may include a document type, a document content and/orlink, location information and/or a scanner ID. The scan results mayalso include document metadata.

The various scanners may connect to an organization's data source(s) 860in order to find documents, as discussed above. In certain embodiments,the scanner(s) 850 may expose an API to: start the scan, check status,and/or retrieve results relating to documents. The scanner(s) 850 maysubmit a job to run a scan based on values in an input file. And suchscanners may store results in the shared database 840 via the API.

In certain embodiments, the system may integrate with third-partysystems and applications, such as data protection systems. A third-partyscanner 854 may be employed to retrieve documents from a database 874relating to such third-party systems. Additionally or alternatively, thesystem may expose an API for third-party systems 805 and applications toquery stored data and/or metadata.

Generally, the system may be configured to scan multiple data sources860 of multiple types (e.g. Identity data sources 861, Hadoop datasources 862, file share data sources 863, and so on). In one embodiment,each type of data source (861-863) may be scanned by a scanner (851-853)specifically adapted to scan that type of data source. In otherembodiments, a single scanner may be employed to scan multiple types ofdata sources. Each of the scanners 850 may leverage the target datasource's 860 native search capabilities and/or may run as part of thedata source. For example, a Hadoop scanner 852 may run a MapR job toscan a Hadoop data source 862.

Scalability may be achieved by adding more instances of a given scanner,where each scanner can pick up a scanning job and run in parallel toother scanners. Each scanner instance may check the shared database tosee whether there are pending jobs (“scanning tasks”) for it to take.And, when a scanning task exists, an appropriate scanner may beautomatically triggered to perform the scan.

For some scanners 850, it may be desirable to achieve parallelism bysplitting the work into separate scans. For example each type ofdocument may be separated to a different scan (e.g., a first scan maysearch for a first type of document and a second scan may search for asecond type of document). As another example, scans may be separated byalphabetical splitting (e.g., a first scan may search for documentsbeginning with letters a-f and a second scan may search for documentsbeginning with letters g-z). For certain scanners the system's nativeparallelism may be exploited.

In one embodiment, the system may comprise an orchestrator component 831adapted to call and coordinate separate handlers and/or microservices.For example, the orchestrator component may interact with scannercomponents 850, the correlator 833, the risk and rules component 832,data sources 860, the shared database component 840 and/or themanagement server component 812. Generally, the orchestrator component831 receives information relating to a data subject's personalinformation and prepares the information for the scanners 850 (e.g., viainput files). It may also trigger the scanners and, upon completion,retrieve the results and transmit the same to the shared databasecomponent with additional metadata.

The orchestrator component 831 may be responsible for one or more of thefollowing: providing configuration data for the scanners 850 (via inputfrom a user); scheduling the scans, refreshes etc.; executingcorrelation logic; executing rule evaluation and generating violations;and/or running business information processing (e.g. summary,aggregation, etc. required for user interface screens). In certainembodiments, the orchestrator 831 may generate metadata summaries and/orupload the same to the management server component 812. The orchestratorcomponent 831 can also run further processing, such as risk calculationsand compliance determinations.

An exemplary orchestrator workflow may include the following steps: (1)run scan of data source(s); (2) check when finished; (3) prepare a givenscanner launch by retrieving, from the correlator component 833, a listof documents to scan and creating an input file with the documentinformation; (4) run the given scanner 850 with the input file; (5)determine that the scanner has completed the scan; and (6) call thecorrelator component to review the scan results. Depending on specificrequirements and/or constraints of any of the scanners, results may bewritten directly to the shared database 840 such that the orchestratorcomponent 831 can read the results directly when the scan is complete.

The correlator component 833 may be employed to preprocess documentsand/or cluster documents according to the above described processes. Itwill be appreciated that documents may include sensitive values. Wherepossible, the system may only store hashed pointers to documents. Wherenot possible, all temporary data may be wiped.

In certain embodiments, the system may further comprise a risk and rulescomponent 832 that provides activity information relating to datasources 860, including but not limited to, applications, accounts,and/or personal information records that are used or accessed. Suchactivity data may be determined via SIEM, digital asset management(“DAM”) and/or cloud access security broker (“CASB”) products. And suchdata may be stored in the shared database (e.g., in the activities table847).

Still referring to FIG. 8, the system further comprises a cloud-basedmanagement server module 810. This module comprises a number ofcomponents, including an administrative database component 820, amanagement server 812, and a client application component 811.

The administrative database component 820 may store information in anumber of database tables (821-824), such as a metadata summaries table821, a tenants information table 822, a users table 823 and/or a taskstable 824. As shown various components and/or microservices may accessthe administrative database component 820 to store and/or retrieveinformation.

The system may further comprise a client application 811 to displayinformation in graphical format to any number of users. The clientapplication 811 may comprise a multi-tenant, web-based application(e.g., using AngularJS) that runs on a web browser of a client device801. The client application may allow for the creation and viewing ofdocuments, document information, clusters and/or cluster informationthrough the remote management of the on-premise elements of thedifferent tenants. The client application 811 may comprise a SaaSdistributed application packaged in containers and remotely hosted toallow simple porting to be delivered as an on-premise, private-cloudapplication.

In certain embodiments, a user may access the client application toperform customer registration activities. For example, the clientapplication may allow the user to download and register on-premiseelements; setup and manage personal information discovery tasks; performsoftware updates to self-service elements; monitor system health; and/oraccess any user interface screens of the platform.

Although not shown, in certain embodiments, an analytics andconfiguration component may be employed to provide the backend for anAPI consumed by one or more user interface screens of the clientapplication. This component may send instructions to the main module 830by adding activities, such as activities polled by the main module.

Embodiments of the subject matter and the functional operationsdescribed in this specification can be implemented in one or more of thefollowing: digital electronic circuitry; tangibly embodied computersoftware or firmware; computer hardware, including the structuresdisclosed in this specification and their structural equivalents; andcombinations thereof. Such embodiments can be implemented as one or moremodules of computer program instructions encoded on a tangiblenon-transitory program carrier for execution by, or to control theoperation of, data processing apparatus (i.e., one or more computerprograms). Program instructions may be, alternatively or additionally,encoded on an artificially generated propagated signal (e.g., amachine-generated electrical, optical, or electromagnetic signal) thatis generated to encode information for transmission to suitable receiverapparatus for execution by a data processing apparatus. And the computerstorage medium can be one or more of: a machine-readable storage device,a machine-readable storage substrate, a random or serial access memorydevice, and combinations thereof.

As used herein, the term “data processing apparatus” comprises all kindsof apparatuses, devices, and machines for processing data, including butnot limited to, a programmable processor, a computer, and/or multipleprocessors or computers. Exemplary apparatuses may include specialpurpose logic circuitry, such as a field programmable gate array(“FPGA”) and/or an application specific integrated circuit (“ASIC”). Inaddition to hardware, exemplary apparatuses may comprise code thatcreates an execution environment for the computer program (e.g., codethat constitutes one or more of: processor firmware, a protocol stack, adatabase management system, an operating system, and a combinationthereof).

The term “computer program” may also be referred to or described hereinas a “program,” “software,” a “software application,” a “module,” a“software module,” a “script,” or simply as “code.” A computer programmay be written in any form of programming language, including compiledor interpreted languages, or declarative or procedural languages, and itcan be deployed in any form, including as a standalone program or as amodule, component, subroutine, or other unit suitable for use in acomputing environment. Such software may correspond to a file in a filesystem. A program can be stored in a portion of a file that holds otherprograms or data. For example, a program may include one or more scriptsstored in a markup language document; in a single file dedicated to theprogram in question; or in multiple coordinated files (e.g., files thatstore one or more modules, sub programs, or portions of code). Acomputer program can be deployed and/or executed on one computer or onmultiple computers that are located at one site or distributed acrossmultiple sites and interconnected by a communication network.

The processes and logic flows described in this specification can beperformed by one or more programmable computers executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows can also be performedby, and apparatus can also be implemented as, special purpose logiccircuitry, such as but not limited to an FPGA and/or an ASIC.

Computers suitable for the execution of the one or more computerprograms include, but are not limited to, general purposemicroprocessors, special purpose microprocessors, and/or any other kindof central processing unit (“CPU”). Generally, CPU will receiveinstructions and data from a read only memory (“ROM”) and/or a randomaccess memory (“RAM”). The essential elements of a computer are a CPUfor performing or executing instructions and one or more memory devicesfor storing instructions and data. Generally, a computer will alsoinclude, or be operatively coupled to receive data from or transfer datato, or both, one or more mass storage devices for storing data (e.g.,magnetic, magneto optical disks, and/or optical disks). However, acomputer need not have such devices. Moreover, a computer may beembedded in another device, such as but not limited to, a mobiletelephone, a personal digital assistant (“PDA”), a mobile audio or videoplayer, a game console, a Global Positioning System (“GPS”) receiver, ora portable storage device (e.g., a universal serial bus (“USB”) flashdrive).

Computer readable media suitable for storing computer programinstructions and data include all forms of nonvolatile memory, media andmemory devices. For example, computer readable media may include one ormore of the following: semiconductor memory devices, such as erasableprogrammable read-only memory (“EPROM”), electrically erasableprogrammable read-only memory (“EEPROM”) and/or and flash memorydevices; magnetic disks, such as internal hard disks or removable disks;magneto optical disks; and/or CD-ROM and DVD-ROM disks. The processorand the memory can be supplemented by, or incorporated in, specialpurpose logic circuitry.

To provide for interaction with a user, embodiments may be implementedon a computer having any type of display device for displayinginformation to a user. Exemplary display devices include, but are notlimited to one or more of: projectors, cathode ray tube (“CRT”)monitors, liquid crystal displays (“LCD”), light-emitting diode (“LED”)monitors and/or organic light-emitting diode (“OLED”) monitors. Thecomputer may further comprise one or more input devices by which theuser can provide input to the computer. Input devices may comprise oneor more of: keyboards, a pointing device (e.g., a mouse or a trackball).Input from the user can be received in any form, including acoustic,speech, or tactile input. Moreover, feedback may be provided to the uservia any form of sensory feedback (e.g., visual feedback, auditoryfeedback, or tactile feedback). A computer can interact with a user bysending documents to and receiving documents from a device that is usedby the user (e.g., by sending web pages to a web browser on a user'sclient device in response to requests received from the web browser).

Embodiments of the subject matter described in this specification can beimplemented in a computing system that includes one or more of thefollowing components: a backend component (e.g., a data server); amiddleware component (e.g., an application server); a front endcomponent (e.g., a client computer having a graphical user interface(“GUI”) and/or a web browser through which a user can interact with animplementation of the subject matter described in this specification);and/or combinations thereof. The components of the system can beinterconnected by any form or medium of digital data communication, suchas but not limited to, a communication network. Non-limiting examples ofcommunication networks include a local area network (“LAN”) and a widearea network (“WAN”), e.g., the Internet.

The computing system may include clients and/or servers. The client andserver may be remote from each other and interact through acommunication network. The relationship of client and server arises byvirtue of computer programs running on the respective computers andhaving a client-server relationship to each other.

Various embodiments are described in this specification, with referenceto the detailed discussed above, the accompanying drawings, and theclaims. Numerous specific details are described to provide a thoroughunderstanding of various embodiments. However, in certain instances,well-known or conventional details are not described in order to providea concise discussion. The figures are not necessarily to scale, and somefeatures may be exaggerated or minimized to show details of particularcomponents. Therefore, specific structural and functional detailsdisclosed herein are not to be interpreted as limiting, but merely as abasis for the claims and as a representative basis for teaching oneskilled in the art to variously employ the embodiments.

The embodiments described and claimed herein and drawings areillustrative and are not to be construed as limiting the embodiments.The subject matter of this specification is not to be limited in scopeby the specific examples, as these examples are intended asillustrations of several aspects of the embodiments. Any equivalentexamples are intended to be within the scope of the specification.Indeed, various modifications of the disclosed embodiments in additionto those shown and described herein will become apparent to thoseskilled in the art, and such modifications are also intended to fallwithin the scope of the appended claims.

While this specification contains many specific implementation details,these should not be construed as limitations on the scope of anyinvention or of what may be claimed, but rather as descriptions offeatures that may be specific to particular embodiments of particularinventions. Certain features that are described in this specification inthe context of separate embodiments can also be implemented incombination in a single embodiment. Conversely, various features thatare described in the context of a single embodiment can also beimplemented in multiple embodiments separately or in any suitablesubcombination. Moreover, although features may be described above asacting in certain combinations and even initially claimed as such, oneor more features from a claimed combination can in some cases be excisedfrom the combination, and the claimed combination may be directed to asubcombination or variation of a subcombination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various system modulesand components in the embodiments described above should not beunderstood as requiring such separation in all embodiments, and itshould be understood that the described program components and systemscan generally be integrated together in a single software product orpackaged into multiple software products.

All references, including patents, patent applications and publicationscited herein are incorporated herein by reference in their entirety andfor all purposes to the same extent as if each individual publication orpatent or patent application was specifically and individually indicatedto be incorporated by reference in its entirety for all purposes.

What is claimed is:
 1. A computer-implemented method of clustering aplurality of documents, the method comprising: receiving a plurality ofdocuments from one or more data sources; preprocessing a document in theplurality of documents to generate preprocessed text comprising aplurality of tokens; applying a hashing function to the preprocessedtext to calculate a hash of the document; determining a feature vectorof the document based on the preprocessed text; retrieving a set ofclusters, each cluster associated with one or more associated documents,a hash list, and a cumulative feature vector; determining a comparisonscore between the hash of the document and each of the hash lists of theclusters; determining a similarity score between the feature vector ofthe document and each of the cumulative feature vectors of the clusters;and associating the document with a cluster based on the determinedcomparison scores or the determined similarity scores.
 2. Acomputer-implemented method according to claim 1, further comprising:determining that the comparison score between the hash of the documentand the hash list of a matching cluster in the set of clusters isgreater than or equal to a comparison threshold, wherein saidassociating the document with a cluster comprises associating thedocument with the matching cluster.
 3. A computer-implemented methodaccording to claim 1, further comprising: upon determining that none ofthe determined comparison scores is greater than or equal to a firstcomparison threshold, determining a maximum comparison score from thedetermined comparison scores, the maximum comparison score correspondingto a matching cluster in the set of clusters; and determining that themaximum comparison score is greater than or equal to a second comparisonthreshold that is lower than the first comparison threshold, whereinsaid associating the document with a cluster comprises associating thedocument with the matching cluster.
 4. A computer-implemented methodaccording to claim 3, wherein: the first comparison threshold is fromabout 110 to about 120; and the second comparison threshold is fromabout 80 to about
 90. 5. A computer-implemented method according toclaim 1, wherein the hashing function employs a scheme selected from thegroup consisting of: feature extraction, locality sensitive hashing(“LSH”), context triggered piecewise hashing (“CTPH”), fuzzy hashing,and trend micro locality sensitive hashing (“TLSH”).
 6. Acomputer-implemented method according to claim 1, wherein: saiddetermining a similarity score between the feature vector of thedocument and each of the cumulative feature vectors of the clusters ispreformed upon determining that none of the determined comparison scoresis greater than or equal to a comparison threshold; and said associatingthe document with a cluster is based on the determined similarityscores.
 7. A computer-implemented method according to claim 6, furthercomprising: determining that the similarity score between the featurevector of the document and the cumulative feature vector of a matchingcluster from in set of clusters is greater than or equal to a similaritythreshold, wherein said associating the document with a clustercomprises associating the document with the matching cluster.
 8. Acomputer-implemented method according to claim 6, further comprising:upon determining that none of the determined similarity scores isgreater than or equal to a first similarity threshold, determining amaximum similarity score from the determined similarity scores, themaximum similarity score corresponding to a matching cluster in the setof clusters; and determining that the maximum similarity score isgreater than or equal to a second similarity threshold that is lowerthan the first similarity threshold, wherein said associating thedocument with a cluster comprises associating the document with thematching cluster.
 9. A computer-implemented method according to claim 8,wherein: the first similarity threshold is at least about 0.9; and thesecond similarity threshold is from about 0.7 to about 0.85.
 10. Acomputer-implemented method according to claim 1, wherein saidgenerating a feature vector of the document comprises: mapping each ofthe plurality of tokens in the preprocessed text to a respective uniqueID; and determining, for each of the unique IDs, a count of the tokensmapped thereto.
 11. A computer-implemented method according to claim 10,wherein the unique ID to which each of the tokens is mapped isdetermined based on a hash calculated for the respective token.
 12. Acomputer-implemented method according to claim 1, wherein each of thesimilarity scores is determined by calculating a cosine similaritybetween the feature vector of the document and the cumulative featurevector of the respective cluster.
 13. A computer-implemented methodaccording to claim 1, wherein said associating the document with acluster comprises: adding the hash of the document to the hash list ofthe cluster; and adding the feature vector of the document to thecumulative feature vector of the cluster.
 14. A computer-implementedmethod according to claim 1, wherein associating the document with acluster comprises: upon determining that none of the determinedcomparison scores is greater than or equal to a comparison threshold andnone of the determined similarity scores is greater than or equal to asimilarity threshold: associating the document with a new cluster;designating the feature vector of the document as the cumulative featurevector of the new cluster; and adding the hash of the document to thehash list of the new cluster.
 15. A computer-implemented methodaccording to claim 1, further comprising: determining a similarity scorebetween the cumulative feature vectors of a first cluster and a secondcluster in the set of clusters; and merging the first cluster with thesecond cluster upon determining that the similarity score is greaterthan or equal to a similarity threshold.
 16. A computer-implementedmethod according to claim 15, wherein said merging the first clusterwith the second cluster comprises: associating the associated documentsof the first cluster with the second cluster; adding the cumulativefeature vector of the first cluster to the cumulative feature vector ofthe second cluster; and adding one or more hashes included in the hashlist of the first cluster to the hash list of the second cluster.
 17. Acomputer-implemented method according to claim 1, further comprising:determining keywords of a cluster in the set of clusters by: determininga set of tokens for the cluster, the set of tokens comprising all of thetokens included in the preprocessed text generated for each of thedocuments associated with the cluster; calculating a Term FrequencyInverse Cluster Frequency (“TFICF”) value for each token in the set oftokens; selecting a number of selected tokens from the set of tokensbased on the calculated TFICF values; and designating each of theselected tokens as a keyword; and displaying the keywords of thecluster.
 18. A machine-readable medium having program instructionsstored thereon, the instructions capable of execution by a processor anddefining the steps of: receiving a plurality of documents from one ormore data sources; preprocessing a document in the plurality ofdocuments to generate preprocessed text comprising a plurality oftokens; applying a hashing function to the preprocessed text tocalculate a hash of the document; determining a feature vector of thedocument based on the preprocessed text; retrieving a set of clusters,each cluster associated with one or more associated documents, a hashlist, and a cumulative feature vector; determining a comparison scorebetween the hash of the document and each of the hash lists of theclusters; determining a similarity score between the feature vector ofthe document and each of the cumulative feature vectors of the clusters;and associating the document with a cluster based on the determinedcomparison scores or the determined similarity scores.
 19. A machinereadable medium according to claim 18, wherein the instructions furtherdefine the steps of: upon determining that none of the determinedcomparison scores is greater than or equal to a first comparisonthreshold, determining a maximum comparison score from the determinedcomparison scores; determining that the maximum comparison score is lessthan a second comparison threshold, wherein the second comparisonthreshold is lower than the first comparison threshold; upon determiningthat none of the determined similarity scores is greater than or equalto a first similarity threshold, determining a maximum similarity scorefrom the determined similarity scores, the maximum similarity scorecorresponding to a matching cluster from the set of clusters; anddetermining that the maximum similarity score is greater than or equalto a second similarity threshold, wherein the second similaritythreshold is lower than the first comparison threshold, wherein saidassociating the document with a cluster comprises: associating thedocument with the matching cluster; adding the hash of the document tothe hash list of the matching cluster; and adding the feature vector ofthe document to the cumulative feature vector of the matching cluster.20. A machine readable medium according to claim 19, wherein theinstructions further define the steps of: determining a set of tokensfor the matching cluster, the set of tokens comprising all of the tokensincluded in the preprocessed text generated for each of the documentsassociated with the matching cluster; calculating a Term FrequencyInverse Cluster Frequency (“TFICF”) value for each token in the set oftokens; selecting, from the set of tokens, a number of selected tokensbased on the calculated TFICF values; designating each of the selectedtokens as a keyword of the matching cluster; and displaying the keywordsof the matching cluster via a user interface.